CVE-2006-2758: Jetty Directory Traversal Vulnerability

The vulnerability stems from improper path normalization when handling URL-encoded characters. Jetty's ResourceHandler is responsible for serving static resources by mapping URLs to filesystem paths. The getResource method would decode the URL parameter and construct a filesystem path. If it fails to properly check for both forward and backslash-based traversal sequences (e.g., ../ or ..) after decoding, it would allow path traversal. The use of %2e%2e%5c (decoded to ..) suggests the handler didn't account for backslashes as path separators during normalization, a common oversight in Java-based web servers handling multi-platform environments.